ReDoS/Catastrophic Backtracking Checker
Check a regex for the shapes known to cause catastrophic backtracking, then time it against input built to trigger them.
About this tool
The checker reads the pattern's structure and looks for the three shapes behind most real-world ReDoS bugs: nested quantifiers such as (a+)+ or (\w+\s?)*, repeated groups whose alternatives can start with the same character such as (a|ab)*, and neighbouring repeated parts that compete for the same characters such as \d+\d+. It understands escapes and character sets, so \(a+\)+ and [(a+)+] aren't flagged by mistake. The first two shapes are marked high risk because the time can double with every extra character; the third is medium risk because it slows down polynomially.
The timing test then checks it in practice: it builds input aimed at the riskiest part (a long run of a character the pattern repeats, ending in one it can't match) and times your pattern on longer and longer versions in a background worker. Fast, flat timings mean the shape isn't exploitable on that input; a run that is still going after 3 seconds is stopped and reported. This is a heuristic, not a formal proof: a flagged pattern deserves a rewrite or an input length limit, and a pattern that passes isn't guaranteed safe on every possible input.